IsValidRemoteURL checks if a URL is valid for remotes (stricter than packages - no localhost allowed)
(rawURL string)
| 133 | |
| 134 | // IsValidRemoteURL checks if a URL is valid for remotes (stricter than packages - no localhost allowed) |
| 135 | func IsValidRemoteURL(rawURL string) bool { |
| 136 | // First check basic URL structure |
| 137 | if !IsValidURL(rawURL) { |
| 138 | return false |
| 139 | } |
| 140 | |
| 141 | // Replace template variables with placeholders before parsing for localhost check |
| 142 | testURL := replaceTemplateVariables(rawURL) |
| 143 | |
| 144 | // Parse the URL to check for localhost restriction |
| 145 | u, err := url.Parse(testURL) |
| 146 | if err != nil { |
| 147 | return false |
| 148 | } |
| 149 | |
| 150 | // Reject localhost URLs for remotes (security/production concerns) |
| 151 | hostname := u.Hostname() |
| 152 | if hostname == "localhost" || hostname == "127.0.0.1" || strings.HasSuffix(hostname, ".localhost") { |
| 153 | return false |
| 154 | } |
| 155 | |
| 156 | if u.Scheme != "https" { |
| 157 | return false |
| 158 | } |
| 159 | |
| 160 | return true |
| 161 | } |
| 162 | |
| 163 | // IsValidTemplatedURL validates a URL with template variables against available variables |
| 164 | // For packages: validates that template variables reference package arguments or environment variables |
no test coverage detected
searching dependent graphs…